Fix display name being displayed instead of domain in remote reports #31613
Conversation
|
Is the notification API here actually leaking the underlying account instead of just the "handle" to the user? We currently don't surface the remote account anywhere in the moderation UI, I suspect for remote reporters we should return an Instance like entity instead? |
Yes
Yes, but that would be a breaking change. Also note that Mastodon itself does obscure the origin of a report when forwarding it, by making it come from the instance actor, so this is not really a concern on our side, but other implementations are not consistently doing that. |
|
hm, okay, that is unfortunate that the API will give more data than we necessarily should. But further reinforces using instance actors or moderator actor for forwarding reports via Flag activities (I'm going to try to work on standardising Flag and it's usage to align with what software needs) |
Mastodon anonymizes local reports when forwarding them, but that is not always the case of other software.
The moderation interface already hides the particular account attached to remote reporters, so it makes sense to hide it in the report notifications as well (even though the full account is returned by the API).
Furthermore, since the display names do not have hover cards or individual links, this PR changes the notifications to use the usernames rather the display names, as those can be changed and could be misleading.